SECUFOCUSNOW
Home›CVE index›CVE-2026-31431
CISA KEV · Known exploitedHigh

CVE-2026-31431

Linux Linux, NVIDIA for RHEL 10, Red Hat Enterprise Linux 10

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

CVSS
7.8
EPSS
94.5%
99.8% percentile
CISA KEV
Listed
Published
2026.04.22
PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV
Exploit probability94.5%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

Affected product and versions

Product
Linux Linux, NVIDIA for RHEL 10, Red Hat Enterprise Linux 10
Affected versions
>= 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < 893d22e0135fa394db81df88697fba6032747667, >= 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < 19d43105a97be0810edbda875f2cd03f30dc130c, >= 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < 961cfa271a918ad4ae452420e7c303149002875b, >= 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < 3115af9644c342b356f3f07a4dd1c8905cd9a6fc, >= 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < 8b88d99341f139e23bdeb1027a2a3ae10d341d82, >= 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8, >= 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < ce42ee423e58dffa5ec03524054c9d8bfd4f6237, >= 72548b093ee38a6d4f2a19e6ef1948ae05c181f7 < a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5, >= 4.14, >= V3.1.6, >= V3.1.5, >= 4.14 < 5.10.254, >= 5.11 < 5.15.204, >= 5.16 < 6.1.170, >= 6.2 < 6.6.137, >= 6.7 < 6.12.85, >= 6.13 < 6.18.22, >= 6.19 < 6.19.12, 7.0, >= 4.12 < 4.12.89
Fixed versions
5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22, 6.19.12, 4.12.89, 4.13.66, 4.14.65, 4.15.64, 4.16.61, 4.17.53, 4.18.40, 4.19.30, 4.20.21, 4.21.14, 25.11, 7.1.0, 1.1

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
CISA required action

"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Due date: 2026.05.15
  1. 1
    Identify

    Confirm that Linux Linux, NVIDIA for RHEL 10, Red Hat Enterprise Linux 10 and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-1288, CWE-669
KEV added
2026.05.01
Ransomware use
미확인